Order-to-Cash Walkthrough Documentation Example

A walkthrough follows one transaction through the process, from initiation to the financial statements, to confirm that the auditor's understanding of the process is right and that the controls described are actually in place. It is the bridge between the risk assessment and the control tests. This post documents one for the revenue cycle. The general method is in internal control questionnaire and walkthroughs, and the testing that follows is in control testing guide. The purchasing counterpart is in procure-to-pay walkthrough. For the internal-audit view of the same cycle, a risk and control matrix with a test step per control, see the order-to-cash RCM; this post covers the auditor's walkthrough record instead: the narrative, the interviews and the deviations from what management described.

What a walkthrough proves

It proves understanding and implementation. It does not prove operating effectiveness. That requires a sample over the period. The walkthrough tells the auditor what the process is, who does what, what systems and documents are used, which controls address which risks, and whether the controls exist. It uses inquiry, observation, inspection of documents and tracing a transaction. Inquiry alone is not enough.

How to run it

Pick a transaction from the current period. Choose one with typical features and, in another pass, one with unusual features such as a credit memo or a manual invoice.
Interview the people who do each step, not only the manager who describes the process.
Ask them to show you the screens, reports and documents involved.
Trace the transaction through every step from order to ledger to cash.
Record the controls you see, the risk each addresses and what evidence shows it operates.
Note the points where the process departs from what you were told.

The example: a manufacturer selling to commercial customers

Illustrative narrative of a company with a December year end. Steps, owners and controls:

Step	Who	What happens	Control point	Evidence
1. Customer set-up	Credit manager	New customer form with credit application and references; credit limit set	Credit approval by manager and CFO above a threshold	Signed forms, system limit
2. Order entry	Sales support	Order entered from the customer purchase order	System compares price to the price master; changes require approval	Order record, price override log
3. Credit check	System	Order held if over limit	Automatic hold, release by credit manager	Hold report
4. Fulfillment	Warehouse	Pick ticket printed from the approved order; goods staged	Pick ticket from system only	Pick tickets
5. Shipping	Shipping clerk	Goods loaded, bill of lading signed by carrier	Quantity checked against pick ticket; BOL numbered	BOL, shipping log
6. Invoicing	Billing clerk	Invoice generated from the shipment record	Invoice only from shipped orders, via system interface	Shipping-to-billing exception report
7. Revenue posting	System	Interface posts revenue and receivable	Automated posting; daily reconciliation of the billing register to the ledger	Reconciliation, sign-off
8. Credit memos	Billing clerk, approved by sales manager	Returns and price adjustments	Approval above $2,500; reason codes	Credit memo log
9. Cash receipt	Cash applications clerk	Customer pays by check or ACH; lockbox deposit	Lockbox collects and deposits checks; clerk applies from the remittance file	Lockbox report, remittance
10. Collections	Credit manager	Aging review monthly; follow-up	Review of aging with notes; write-off approval by CFO	Aging with initials
11. Allowance	Controller	Quarterly calculation	Review by CFO	Calculation, review sign-off
12. Month-end	Controller	Subledger to GL reconciliation	Reviewed and signed by controller	Reconciliation

What to note at each step

For each step the walkthrough workpaper records:

The inputs and outputs, and the document or system record produced.
The people and their roles, and what other tasks they perform. If the person who creates invoices can also post cash, that is a segregation point.
The control activity and the risk it addresses, tied to an assertion: occurrence, completeness, accuracy, cutoff.
Whether the control is manual or automated, and how often it operates.
The system and any interfaces. Automated controls need a test of general IT controls.
Whether anything differs from what the process owner described.

Control points and risks

Risk	Assertion	Control that addresses it
Fictitious customers or orders	Occurrence	Credit approval, price master, order from customer purchase order
Shipments not invoiced	Completeness	Shipping-to-billing exception report
Invoicing without shipment	Occurrence, cutoff	Invoices generated from shipment records only
Wrong price	Accuracy	Price master with approvals for overrides
Revenue recorded in the wrong period	Cutoff	Daily reconciliation, cutoff review at month-end
Credits issued without authority	Occurrence	Credit memo approval
Cash misapplied or stolen	Existence	Lockbox, segregation of cash application from collection
Overstated receivables	Valuation	Aging review, allowance review

Deviations found in the example

During the walkthrough the auditor finds two items that the narrative did not mention:

Manual invoices. The billing clerk can create an invoice outside the system for special orders. There is no log. These bypass the shipping interface and are a cutoff and occurrence risk. The auditor records the control gap, plans to test manual invoices specifically and notes it for the deficiency evaluation.
Price overrides. The system allows sales support to override prices without approval for orders below $5,000. The price override log exists but no one reviews it.

The walkthrough has done its job. It found where the process departs from the description, and where controls that the client believed existed do not.

From walkthrough to tests

Walkthrough finding	Follow-up
Automated invoicing from shipments	Test the interface and general IT controls, or test a sample of invoices to shipments
Credit memo approval control	Attribute test of credit memos above the threshold. See attribute sampling
Daily reconciliation	Inspect reconciliations for a sample of days
Shipping-to-billing exception report	Inspect the report and the follow-up of exceptions
Manual invoices	Substantive test of all manual invoices above a threshold
Price overrides	Substantive price testing and a data test of overrides

Controls the auditor does not plan to rely on do not need operating effectiveness tests, but the walkthrough still informs the substantive plan. See revenue testing.

Documentation

A walkthrough workpaper contains a narrative or flowchart, the transaction traced with document references, the people interviewed with dates, the controls identified with the risk and assertion, the deviations from the description, and the conclusion on design and implementation. Date each walkthrough and update it if the process changes during the year. Update it each year for key controls to confirm the process is unchanged, even if the client says nothing has changed.

CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.

Sources

AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement; AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, sections 320 and 350 (walk-throughs to confirm the understanding of business processes, and observation and inspection in control tests): gao.gov

Part of CORAA University · Working papers and documentation: related guides, calculators and templates.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error

Order-to-Cash Walkthrough: A Documented Example With Control Points and Tests